Security Monitoring
• Analyze detections and alerts and respond to security threats from Firewall (FW), Intrusion Detection Systems (IDS), Intrusion Prevention Systems (IPS), Antivirus (AV), Endpoint Detection and Response (EDR) and other security threat data sources.
• Conduct Security Monitoring activities to provide Security in Depth visibility into potential known and unknown threats that may pose risk to the IBM environment.
• Document actions in cases to effectively communicate information to internal stakeholders as well has for historical retrieval.
• Resolve problems independently and understand escalation procedures.
• Participate in security incidents and act as the technical Subject Matter Expert during significant security incidents.
• Conduct operations surrounding cyber security incident response technologies including network logging and forensics, security information and event management tools, security analytics platforms, log search technologies, and host based forensics as applicable.
• Act as an internal information security consultant to the business and technology units, advising on risks, threats and control practices related to Rapid Response.
• Assist in development and knowledge sharing within the team.
• Assist in security console tuning.
• Assist in establishing Global Security Monitoring discipline to support enterprise• Identify and share threat intelligence that impacts IBM and their customers or products
• Experience with Linux, Windows and MacOS systems
• Critical thinking and problem solving skills
• Passion for information security and data security
• Strong written/verbal communication skills
• Strong interpersonal and organization skills
• At least 2 years’ experience in Incident Response in a global corporate enterprise
• Experience in fast-paced investigations
• Experience with programming or scripting languages
• Familiarity with IBM QRadar SIEM, Windows Defender ATP and EDR platforms is a plus
